Computer Forensic Fundamentals in Modern Computing Environment
The field of computer forensics has become increasingly significant due to rising cybercrimes. Dr. SNS Rajalakshmi College of Arts & Science offers insights into computer forensic services, including data collection, analysis, and investigations. Digital evidence plays a crucial role in both legal proceedings and corporate investigations, helping uncover misuse of technology in workplaces and potential fraud activities. Through the exploration of computer forensic fundamentals, individuals and businesses can better protect their digital assets and discover illicit activities.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Dr. SNS RAJALAKSHMI COLLEGE OF ARTS & SCIENCE (Autonomous) Coimbatore -641049 Accredited by NAAC(Cycle III) with A+ Grade (Recognized by UGC, Approved by AICTE, New Delhi and Affiliated to Bharathiar University, Coimbatore) DEPARTMENT OF COMPUTER APPLICATIONS COURSE NAME : Operating System Forensic I YEAR /II SEMESTER Unit 2-Computer Forensic Fundamentals Topic 1 :Computer Forensic Fundamentals:
Computer Forensic Services 1. Elvidence provides a wide range of computer forensic services, ranging from data collection and analysis to computer hacking investigations and expert witness services. Whilst this type of work is often linked to gathering evidence for court cases it can have many other uses too. Here s a look at some of what we can do for businesses and individuals. 5/26/2020 2/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services Computer Forensics There s been a significant rise in the amount of computer and internet related crime in recent years. This is hardly surprising as we increasingly rely on computers and the internet to carry out transactions and store and exchange information. The very nature of computers means that whatever you do leaves a trail of evidence, but in order to be used in court this needs to be gathered and handled in such a way that it isn t compromised. This is where digital forensics comes into play. 5/26/2020 3/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services 1. Though the gathering of digital evidence now plays a key part in the investigation of many crimes, it s also used by a growing number of businesses. The skills of a computer investigator can be useful in uncovering misuse of company computers or email, or the copying and leaking of data from within an organisation. Our services can of course be adapted to meet the specific needs of the client. 5/26/2020 4/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services Workplace and Fraud Investigation Often abuses of computer and other digital systems happen in the workplace. This can take a number of forms such as staff viewing inappropriate material using work internet connections, or passing commercially sensitive information to competitors. In some cases maybe even setting up a new business in opposition to their employer. Forensic examination of computers and mobile devices can reveal what has been happening. Computer investigations are something that can be carried out covertly if required. 5/26/2020 5/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services In some cases this activity may amount to actual fraud. Most financial and other transactions today are recorded electronically and devices in an organization may therefore need to be examined to determine if fraudulent activity has taken place. Transaction information is only part of the story though. Often other documents and emails can help identify the falsifying of stock records or invoices which in turn can indicate that fraudulent activity has taken place. 5/26/2020 6/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services The problem is that these logs are often overwritten on a rolling basis so evidence can be wiped out. When signs of a problem are detected therefore it s vital to act fast in order to preserve information. Having an experienced digital forensic expert do this is essential as the information may end up as evidence in a court case and if it s incorrectly handled it could jeopardise the outcome. 5/26/2020 7/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services Computer Hacking Investigations Another problem faced by businesses today is unauthorized access to information. This can take place internally through the misuse of legitimate credentials, or by someone trying to break into a system from outside. Hacking and unauthorized access can often go undetected until some other activity such as actual theft of data has taken place. There are usually log files available that record access to a computer by particular users or from particular internet addresses. 5/26/2020 8/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services Computer Hacking Investigations Another problem faced by businesses today is unauthorised access to information. This can take place internally through the misuse of legitimate credentials, or by someone trying to break into a system from outside. Hacking and unauthorised access can often go undetected until some other activity such as actual theft of data has taken place. There are usually log files available that record access to a computer by particular users or from particular internet addresses. 5/26/2020 9/50 DEPARTMENT OF COMPUTER APPLICATIONS
Computer Forensic Services Types of Computer Forensics Technology Today, there is an increased opportunity for cyber crime, making advances in the law enforcement, legal, and forensic computing technical arenas imperative Criminal investigators rely on recognized scientific forensic disciplines, such as medical pathology, to provide vital information used in apprehending criminals and determining their motives Cyber forensics is the discovery, analysis, and reconstruction of evidence extracted from any element of Computer systems, Computer networks, Computer media, and Computer peripherals that allow 5/26/2020 DEPARTMENT OF COMPUTER APPLICATIONS 10/50 investigators solve crime
Types of Computer Forensics Technology Two distinct components exist in the emerging field of cyber forensics technology: The first, computer forensics, deals with gathering evidence from computer media seized at the crime scene. Principal concerns with computer forensics involveimaging storage media, recovering deleted files, searching slack and free space, and preserving the collected information for litigation purposes. Several computer forensic tools are available to investigators. The second component, network forensics, is a more technically challenging aspect of cyber forensics. 5/26/2020 11/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Computer Forensics Technology Similar to traditional medical forensics, such as pathology, today s computer forensics is generally performed post-mortem (after the crime or event occurred). In a networked, distributed environment, it is imperative to perform forensic-like examinations of victim information systems on an almost continuous basis, in addition to traditional post-mortem forensic analysis. . 5/26/2020 12/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Computer Forensics Technology Forensic tools are available to assist in pre-empting the attacks or locating the perpetrators. In locating hackers investigators must perform cyber forensic functions in support of various objectives, these objectives include timely cyber attack containment, perpetrator location and identification, damage mitigation, and recovery initiation in the case of a crippled, yet still functioning, network. Standard intrusion analysis includes examination of many sources of data evidence (intrusion detection system logs, firewall logs, audit trails, and network management information). 5/26/2020 13/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Computer Forensics Technology Two distinct components exist in the emerging field of cyber forensics technology: The first, computer forensics, deals with gathering evidence from computer media seized at the crime scene. Principal concerns with computer forensics involve imaging storage media, recovering deleted files, searching slack and free space, and preserving the collected information for litigation purposes. Several computer forensic tools are available to investigators. The second component, network forensics, is a more technically challenging aspect of cyber forensics. 5/26/2020 14/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Computer Forensics Technology It involves gathering digital evidence that is distributed across large-scale, Complex networks. Often this evidence is transient in nature and is not preserved within permanent storage media Network forensics deals primarily with in-depth analysis of computer network intrusion evidence . 5/26/2020 15/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Military Computer Forensic Technology The U.S. Department of Defense (DoD) cyber forensics includes evaluation and in-depth examination of data related to both the trans- and post- cyberattack periods. Key objectives of cyber forensics include rapid discovery of evidence, estimate of potential impact of the malicious activity on the victim, and assessment of the intent and identity of the perpetrator. Real-time tracking of potentially malicious activity is especially difficult when the pertinent information has been intentionally or maliciously hidden, destroyed, or modified in order to elude discovery. 5/26/2020 16/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Military Computer Forensic Technology The Information Directorate s cyber forensic concepts are new and untested. The directorate entered into a partnership with the National Institute of Justice via the auspices of the National Law Enforcement and Corrections Technology Center (NLECTC) located in Rome, New York, to test these new ideas and prototype tools. The Computer Forensics Experiment 2000 (CFX-2000) resulted from this partnership. This first-of-a-kind event represents a new paradigm for transitioning cyber forensic technology from military research and development (R&D) laboratories into the hands of law enforcement. The experiment used a realistic cyber crime scenario specifically designed to exercise and show the value added of the directorate-developed cyber forensic technology. 5/26/2020 17/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Military Computer Forensic Technology The central hypothesis of CFX-2000 examined the possibility of accurately determining the motives, intent, targets, sophistication, identity, and location of cyber criminals and cyber terrorists by deploying an integrated forensic analysis framework. The execution of CFX-2000 required the development and simulation of a realistic, complex cyber crime scenario exercising conventional, as well as R&D prototype, cyber forensic tools. 5/26/2020 18/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Military Computer Forensic Technology The NLECTC assembled a diverse group of computer crime investigators from DoD and federal, state, and local law enforcement to participate in the CFX-2000 exercise hosted by the New York State Police s Forensic Investigative Center in Albany, New York. Officials divided the participants into three teams. Each team received an identical set of software tools and was presented with identical initial evidence of suspicious activity. The objective of each team was to uncover several linked criminal activities from a maze of about 30 milestones that culminated in an information warfare crime (Figure 2.1).[i] 5/26/2020 19/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Military Computer Forensic Technology The cyber forensic tools involved in CFX-2000 consisted of commercial off-the- shelf software and directorate-sponsored R&D prototypes. The SI-FI integration environment, developed under contract by WetStone Technologies, Inc.,[ii]was the cornerstone of the technology demonstrated. SI-FI supports the collection, examination, and analysis processes employed during a cyber forensic investigation. The SI-FI prototype uses digital evidence bags (DEBs), which are secure and tamperproof containers used to store digital evidence. Investigators can seal evidence in the DEBs and use the SI-FI implementation to collaborate on complex investigations. Authorized users can securely reopen the DEBs for examination, while automatic audit of all actions ensures the continued integrity 5/26/2020 DEPARTMENT OF COMPUTER APPLICATIONS 20/50 of its contents
Types of Military Computer Forensic Technology The teams used other forensic tools and prototypes to collect and analyze specific features of the digital evidence, perform case management and timelining of digital events, automate event link analysis, and perform steganography detection. The results of CFX-2000 verified that the hypothesis was largely correct and that it is possible to ascertain the intent and identity of cyber criminals. As electronic technology continues its explosive growth, researchers need to continue vigorous R&D of cyber forensic technology in preparation for the onslaught of cyber reconnaissance probes and attacks. 5/26/2020 21/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Finally, let s briefly look at the following types of business computer forensics technology: 1. Remote monitoring of target computers 2. Creating traceable electronic documents 3. Theft recovery software for laptops and PCs 4. Basic forensic tools and techniques 5. Forensic services available 5/26/2020 22/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Remote Monitoring of Target Computers Data Interception by Remote Transmission (DIRT) from Codex Data Systems (CDS), Inc.[ix]is a powerful remote control monitoring tool that allows stealth monitoring of all activity on one or more target computers simultaneously from a remote command center. No physical access is necessary. Application also allows agents to remotely seize and secure digital evidence prior to physically entering suspect premises. 5/26/2020 23/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Creates Trackable Electronic Documents Binary Audit Identification Transfer (BAIT) is another powerful intrusion detection tool from CDS[x]that allows the user to create trackable electronic documents. Unauthorized intruders who access, download, and view these tagged documents will be identified (including their location) to security personnel. BAIT also allows security personnel to trace the chain of custody and chain of command of all who possess the stolen electronic documents. 5/26/2020 24/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Theft Recovery Software for Laptops and PCs If your PC or laptop is stolen, is it smart enough to tell you where it is? According to a recent FBI report, 97% of stolen computers are never recovered. Also, according to Safeware Insurance, 756,000 PCs and laptops were stolen in 1997 and 1998, costing owners $2.3 billion dollars. And, according to a recent joint Computer Security Institute/FBI survey, 69% of the Fortune 1000 companies experienced laptop theft. Nationwide losses of computer component theft cost corporate America over $8 billion a year. So, if your company experiences computer-related thefts and you do nothing to correct the problem, there is an 89% chance you will be hit again. 5/26/2020 25/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Basic Forensic Tools and Techniques The Digital Detective Workshop from CDS was created to familiarize investigators and security personnel with the basic techniques and tools necessary for a successful investigation of Internet and computer-related crimes. Topics include: types of computer crime, cyber law basics, tracing e-mail to source, digital evidence acquisition, cracking passwords, monitoring computers remotely, tracking on-line activity, finding and recovering hidden and deleted data, locating stolen computers, creating trackable files, identifying software pirates, and so on. 5/26/2020 26/50 DEPARTMENT OF COMPUTER APPLICATIONS
Types of Business Computer Forensic Technology Basic Forensic Tools and Techniques The Digital Detective Workshop from CDS was created to familiarize investigators and security personnel with the basic techniques and tools necessary for a successful investigation of Internet and computer-related crimes. Topics include: types of computer crime, cyber law basics, tracing e-mail to source, digital evidence acquisition, cracking passwords, monitoring computers remotely, tracking on-line activity, finding and recovering hidden and deleted data, locating stolen computers, creating trackable files, identifying software pirates, and so on. 5/26/2020 27/50 DEPARTMENT OF COMPUTER APPLICATIONS
